Skip to content
Heist/ feed
Unrated

kasan: fix cache shrink race with CPU hotplug

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on all online CPUs. Each callback moves objects belonging to the cache from cpu_quarantine to the CPU's shrink_qlist, where they can later be freed from task context. kmem_cache_destroy() invokes the quarantine removal path while holding cpus_read_lock(), but kmem_cache_shrink() does not. The latter can therefore race with CPU offlining as follows: kmem_cache_shrink() CPU hotplug ------------------- ----------- on_each_cpu() CPU1 moves objects to CPU1's shrink_qlist on_each_cpu() returns CPU1 goes offline kasan_cpu_offline() drains cpu_quarantine leaves shrink_qlist untouched for_each_online_cpu() skips CPU1 The objects left on CPU1's shrink_qlist are not returned to the slab allocator. This may prevent kmem_cache_shrink() from releasing slabs that would otherwise become empty. If CPU1 remains offline, a later kmem_cache_destroy() also skips the list and can report that the cache still contains objects. An intermittent occurrence was observed with a virtio-9p filesystem. The mount and umount commands both returned 0, but the kernel logged the following during the userspace-triggered teardown: [ 2994.380134][ T111] BUG 9p-fcall-cache-1 (Tainted: G B ): Objects remaining on __kmem_cache_shutdown() [ 2994.381140][ T111] Object 0xff11000004361118 @offset=4376 [ 2994.381607][ T111] Allocated in p9_fca

Announced Source revision 1
Original source ↗

CVE-2026-93208

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93208

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "07d067e4f2ceb72b9f681995cc53828caaba9e6e",
        "lessThan": "7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "07d067e4f2ceb72b9f681995cc53828caaba9e6e",
        "lessThan": "709c3646545e0a1f99a5816384c633f6552c5a98",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "07d067e4f2ceb72b9f681995cc53828caaba9e6e",
        "lessThan": "30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "07d067e4f2ceb72b9f681995cc53828caaba9e6e",
        "lessThan": "3119d58e4ef8719d669911d38a53fc00086ac48b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "07d067e4f2ceb72b9f681995cc53828caaba9e6e",
        "lessThan": "8790303cbaac52a11dfed4aab261f8ea60682525",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "mm/kasan/quarantine.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.19",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.109",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.50",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.4",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "mm/kasan/quarantine.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-93208

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#37911 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement